bien vu dodoc et j´ai rien vu de mon côté :
tu as ce qu´il faut faire ici
Upon execution, W32.HLLW.Studd performs the following actions:
Copies itself to the following locations:
%Windows%\Temp\Dust.exe
%System%\Dust.exe
--------------------------------------------------
------------------------------
Notes:
%Windir% is a variable. The worm locates the Windows installation folder ( by default, this is C:\Windows or C:\Winnt) and copies itself to that location.
%System% is a variable. The worm locates the System folder and copies itself to that location. By default, this is C:\Windows\System ( Windows 95/98/Me), C:\Winnt\System32 ( Windows NT/2000), or C:\Windows\System32 ( Windows XP).
--------------------------------------------------
------------------------------
Scans the network, looking for any open Administrative shares. If found, the worm will copy itself over as C:\Dust.exe and amend the Autoexec.bat file so that it is executed on startup.
Modifies the following line of the [boot] section of the System.ini file:
Shell=Explorer.exe dust.exe
Connects to a predetermined IRC server, where it can receive further instructions from an attacker.
Once connected to the IRC server, some of the actions an attacker can instruct the worm to carry out are:
If KaZaA is installed, enable sharing and copy itself to the My Shared Folder.
Perform IGMP, SYN, or UDP flood attacks on a specified IP address.
Forward system information to the attacker.
Upload and download files.